Fix use-after-free in resolver SIG(0) async verification path

When a SIG(0)-signed response triggers async ECDSA verification via
dns_message_checksig_async(), the respctx_t holds a raw pointer to
the resquery_t. If the fetch context is shut down while verification
is in flight (e.g. due to recursive-clients quota exhaustion), the
query is destroyed and the callback dereferences a dangling pointer.

Take a reference on the resquery_t when initializing the respctx_t,
and release it in both cleanup paths. The query's own reference to
the fetch context keeps the fctx alive transitively.

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index e66e602888b0c88e7dde0b0f9e31cd22237a2115..50f88209dddb7cb94a37247b8dc2304c0f18f1df 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -7543,6 +7543,7 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
        return;
 
 cleanup:
+       resquery_detach(&rctx->query);
        isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx));
 }
 
@@ -7903,6 +7904,7 @@ resquery_response_continue(void *arg, isc_result_t result) {
        rctx_done(rctx, result);
 
 cleanup:
+       resquery_detach(&rctx->query);
        isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx));
 }
 
@@ -7916,7 +7918,7 @@ static void
 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result,
              isc_region_t *region, respctx_t *rctx) {
        *rctx = (respctx_t){ .result = result,
-                            .query = query,
+                            .query = resquery_ref(query),
                             .fctx = fctx,
                             .broken_type = badns_response,
                             .retryopts = query->options };